#cwe-789

共收录 243 条相关情报。

← 返回所有主题
安全公告2026-07-30 发布INFO

GoAccess WebSocket Server: Signed 32 bit truncation of the 64 bit frame length causes a remote pre-authentication denial of service

CVE-2026-55768

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through the b

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-07-28 发布INFO

gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.UnencryptedMessage.Decode in proto/unencrypted_message.go read attacker controlled dataLen from an unau...

CVE-2026-54638

gotd/td is a T Telegram MTProto API client in Go. Prior to 0.145.1, proto.UnencryptedMessage.Decode in proto/unencrypted

历史摘要 · 未重新核验 · NVD

安全公告2026-07-28 发布INFO

td has pre-auth denial of service via unbounded memory allocation in proto.UnencryptedMessage.Decode

CVE-2026-54638

### Impact A remote, unauthenticated attacker can cause excessive memory allocation (and resulting CPU / GC pressure, p

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-07-27 发布INFO

Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modules) allows Forced Integer Overflow, Excessive Allocation...

CVE-2026-54890

Integer Underflow (Wrap or Wraparound) vulnerability in erlang otp erlang/otp (erts modules), erlang otp erts (erts modu

历史摘要 · 未重新核验 · NVD

安全公告2026-07-23 发布INFO

pypdf: Possible large memory usage for wrong image dimensions

CVE-2026-59938

### Impact An attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires loa

历史摘要 · 未重新核验 · GitHub Advisory

安全公告2026-07-22 发布INFO

Ollama (HEAD f0078ae) contains an uncontrolled memory allocation vulnerability in the GGUF...

CVE-2026-65315

Ollama (HEAD f0078ae) contains an uncontrolled memory allocation vulnerability in the GGUF metadata parser that allows r

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-07-21 发布INFO

Ollama (HEAD f0078ae) contains an uncontrolled memory allocation vulnerability in the GGUF metadata parser that allows remote attackers to crash the server by supplying a crafte...

CVE-2026-65315

Ollama (HEAD f0078ae) contains an uncontrolled memory allocation vulnerability in the GGUF metadata parser that allows r

历史摘要 · 未重新核验 · NVD

漏洞预警2026-07-21 发布INFO

CImg Library is a C++ library for image processing. Prior to version 4.0.0 in `_load_analyze()`, the header_size field is read as an `unsigned int` from the first 4 bytes of an ...

CVE-2026-47667

CImg Library is a C++ library for image processing. Prior to version 4.0.0 in `_load_analyze()`, the header_size field i

历史摘要 · 未重新核验 · NVD

漏洞预警2026-07-21 发布INFO

A flaw was found in libssh. A remote authenticated client can issue SSH_FXP_READ requests with an arbitrarily large length, causing a libssh SFTP server to allocate excessive me...

CVE-2026-59844

A flaw was found in libssh. A remote authenticated client can issue SSH_FXP_READ requests with an arbitrarily large leng

历史摘要 · 未重新核验 · NVD

安全公告2026-07-20 发布INFO

Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service

CVE-2026-59204

### Summary `src/libImaging/Jpeg2KDecode.c:853` accumulates `total_component_width` across every tile in a JPEG2000 imag

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-07-18 发布MEDIUM

SurrealDB versions before 2.2.2 contain a memory exhaustion vulnerability in the string::replace function that fails to restrict resulting string length when using regex pattern...

CVE-2025-71395

SurrealDB versions before 2.2.2 contain a memory exhaustion vulnerability in the string::replace function that fails to

来源摘录 · NVD

漏洞预警2026-07-16 发布INFO

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 6b5370d, h2o is vulnerable to a Denial of Service attack when calling alloca under certain co...

CVE-2026-44453

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 6b5370d, h2o is vulnerable to a Deni

历史摘要 · 未重新核验 · NVD

安全公告2026-07-16 发布INFO

h2o is vulnerable to musl libc stack overflow

CVE-2026-44453

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 6b5370d, h2o is vulnerable to a Deni

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-07-16 发布INFO

Envoy Gateway: OCI layer extraction allocates make([]byte, h.Size) from untrusted tar header

CVE-2026-53717

Vulnerability report without repro case. Repro case may be added later after harness is complete. **Preconditions (4):*

历史摘要 · 未重新核验 · GitHub Advisory

安全公告2026-07-16 发布INFO

Envoy Gateway: Wasm HTTP fetch decompresses gzip without output-size limit

CVE-2026-53716

Vulnerability report without repro case. Repro case may be added later after harness is complete. **Preconditions (4):*

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-07-16 发布INFO

Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Prior to 0.8.0, the decode_unknown_field function in buffa's protobuf decoder al...

CVE-2026-55407

Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Prior to 0.8.0, the dec

历史摘要 · 未重新核验 · NVD

安全公告2026-07-16 发布INFO

Buffa: Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded Allocation

CVE-2026-55407

Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Prior to 0.8.0, the dec

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-07-15 发布INFO

DoS vulnerability in the vibration service. Impact: Successful exploitation of this vulnerability may affect availability.

CVE-2026-58559

DoS vulnerability in the vibration service. Impact: Successful exploitation of this vulnerability may affect availabilit

历史摘要 · 未重新核验 · NVD

安全公告2026-07-14 发布INFO

Trivy: Helm chart tar bomb causes OOM via unbounded io.ReadAll in parser

CVE-2026-54448

## Summary When Trivy scans a Helm chart archive (`.tgz`), its custom tar unpacker reads each entry with `io.ReadAll(tr

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-07-10 发布INFO

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1, when h2o processes a QPACK instruction sent from th...

CVE-2026-55213

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit edd7a120bfc4af11ac0cbebce2a43cc1f93f

历史摘要 · 未重新核验 · NVD